mirror of
https://github.com/openai/codex.git
synced 2026-09-05 15:18:41 +00:00
c6b124bb31
## Why Codex Desktop installs its managed primary runtime under `%USERPROFILE%\.cache\codex-runtimes`. Elevated Windows sandbox commands run as dedicated sandbox users. The synchronous runtime ACL refresh repairs read/execute access for the Desktop runtime directories under `%LOCALAPPDATA%\OpenAI\Codex`, but did not include the managed primary runtime cache. As a result, the Desktop app could discover a bundled runtime while a sandboxed command received `ACCESS_DENIED` when reading or executing it. ## What changed - Include `%USERPROFILE%\.cache\codex-runtimes` in the managed runtime paths considered by the Windows sandbox ACL refresh. - Reuse the existing inherited read/execute ACL repair; no write permission is added. - Add Windows-target regression coverage for the runtime path list and the primary-runtime-only case. ## Impact Bundled Python, Node, and native tools remain usable from elevated Windows sandbox sessions without broadening write access or granting access to the rest of the user profile. ## Validation - `just fmt` - `just test -p codex-windows-sandbox` (10/10 host-side tests passed) - Windows-target path tests included for CI